Splunk Search

Is sparkline adding any new information to my search results?

Justin1224
Communicator

Is sparkline adding any new information to the results of this search, or is it just presenting the same information in a different format?

Here is the search:

| tstats `summariesonly` count from datamodel=Authentication by _time,Authentication.dest span=1h | `drop_dm_object_name("Authentication")` | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest | sort - count

So is the sparkline command actually presenting new data from the tstats command?

Tags (3)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Sparkling command just creates a sparkling (chart/graph).

Sparklines are inline charts that appear within table cells in search results, and are designed to display time-based trends associated with the primary key of each row.

If you are working with stats and chart searches, you can increase their usefulness and overall information density by adding sparklines to their result tables.
A sample sparkling is -
alt text

So is the sparkline command actually presenting new data from the tstats command?
actually, it presents the data from stats command.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

Justin1224
Communicator

Right so what I'm asking is, is this: | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format, or is it actually getting new data? Like, is it getting new data from the indexes that this: | tstats summariesonly count from datamodel=Authentication by _time,Authentication.dest span=1h portion of the search isn't getting?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

About, is | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format,

Yes, exactly. It just does a counting and presenting it as sparkline chart.

The tstats get the data and stats+sparkline does counting and charting.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...